Attachment: ZIP filename mismatch

 1name: "Attachment: ZIP filename mismatch"
 2description: "Detects inbound messages with ZIP attachments that exhibit a mismatch between the filename stored in the local file header and the filename in the central directory."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and any(filter(attachments, .file_type == "zip"),
 8          any(file.explode(.),
 9              any(.scan.yara.matches, .name == "zip_pklfh_cd_fname_mismatch")
10          )
11  )  
12tags:
13  - "Attack surface reduction"
14attack_types:
15  - "Malware/Ransomware"
16tactics_and_techniques:
17  - "Evasion"
18detection_methods:
19  - "Archive analysis"
20  - "YARA"
21  - "File analysis"
22id: "de90dc01-7201-5e0a-bdc2-2f28bd9fd1fe"